Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <0119f3d3-c0f9-503d-db01-22d9dbc15edb@squashfs.org.uk>
Date:   Sun, 6 Nov 2022 17:56:19 +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.4.1
Subject: Re: [PATCH 1/1] squashfs: enable idmapped mounts
To:     =?UTF-8?Q?Michael_Wei=c3=9f?= <michael.weiss@aisec.fraunhofer.de>,
        Christian Brauner <brauner@kernel.org>
Cc:     linux-kernel@vger.kernel.org
References: <20221024191552.55951-1-michael.weiss@aisec.fraunhofer.de>
From:   Phillip Lougher <phillip@squashfs.org.uk>
In-Reply-To: <20221024191552.55951-1-michael.weiss@aisec.fraunhofer.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 24/10/2022 20:15, Michael Weiß wrote:
> For squashfs all needed functionality for idmapped mounts is already
> implemented by the generic handlers in the VFS. Thus, it is sufficient
> to just enable the corresponding FS_ALLOW_IDMAP flag to support
> idmapped mounts.
> 
> We use this for unprivileged (user namespaced) containers based on
> squashfs images as rootfs in GyroidOS.
> 
> A simple test using the mount-idmapped tool executed as user with
> uid=1000 looks as follows:
> 
> $ mkdir test
> $ echo "test" > test/test_file
> $ mksquashfs test/ fs.img
> $ sudo mkdir /mnt/test
> $ sudo mkdir /mnt/mapped
> $ sudo mount fs.img -o loop /mnt/test/
> $ sudo ./mount-idmapped --map-mount b:1000:2000:1 /mnt/test/ /mnt/mapped/
> 
> $ mount | tail -n2
> fs.img on /mnt/test type squashfs (ro,relatime,errors=continue)
> fs.img on /mnt/mapped type squashfs (ro,relatime,idmapped,errors=continue)
> 
> $ ls -lan /mnt/test/
> total 5
> drwxr-xr-x 2 1000 1000   32 Okt 24 13:36 .
> drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
> -rw-r--r-- 1 1000 1000    5 Okt 24 13:36 test_file
> 
> $ ls -lan /mnt/mapped/
> total 5
> drwxr-xr-x 2 2000 2000   32 Okt 24 13:36 .
> drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
> -rw-r--r-- 1 2000 2000    5 Okt 24 13:36 test_file
> 
> Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>

Looks OK.

Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk>

> ---
>   fs/squashfs/super.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
> index 32565dafa7f3..2636cb354435 100644
> --- a/fs/squashfs/super.c
> +++ b/fs/squashfs/super.c
> @@ -568,7 +568,7 @@ static struct file_system_type squashfs_fs_type = {
>   	.init_fs_context = squashfs_init_fs_context,
>   	.parameters = squashfs_fs_parameters,
>   	.kill_sb = kill_block_super,
> -	.fs_flags = FS_REQUIRES_DEV
> +	.fs_flags = FS_REQUIRES_DEV | FS_ALLOW_IDMAP,
>   };
>   MODULE_ALIAS_FS("squashfs");
>